Electronic computing has evolved from primitive, vacuum-tube-based computer systems, initially developed during the 1940s, to modern electronic computing systems in which large numbers of multi-processor computer systems, such as server computers, work stations, and other individual computing systems are networked together with large-capacity data-storage devices and other electronic devices to produce geographically distributed computing systems with hundreds of thousands, millions, or more components that provide enormous computational bandwidths and data-storage capacities. These large, distributed computing systems are made possible by advances in computer networking, distributed operating systems and applications, data-storage appliances, computer hardware, and software technologies.
In order to proactively manage a distributed computing system, system administrators are interested in detecting anomalous behavior in the operation of the disturbed computing system and changes in behavior of the distributed computing system. In recent years, management servers have been developed to monitor the behavior of numerous and various virtual and physical objects of a distributed computing system. A typical management server collects time series metric data from the objects and applies dynamic thresholding techniques to the metric data to identify any number of various anomalies in the operation of the distributed computing system. For example, when metric data of an object violates a threshold, the management server generates an alert that notifies administrators of the anomalous behavior. However, identifying and classifying changes in behavior of a distributed computing system has proven more challenging. Changes have many different causes, including a new software bug, hardware failure, software upgrade, configuration changes, and change in workload. Administrators seek automated methods that identify and classify changes that affect the operations of distributed computing systems.